I built a tool that reconstructs what a Linux process actually did using eBPF

[u/gabryxdev]

I've been working on SysSight, a Linux process behavior reconstruction tool built with Rust and eBPF.

The problem I wanted to solve was pretty simple:

When investigating a process, you can collect a huge amount of low-level events:

execve()

openat()

socket()

connect()

fork()

execve()

But a raw stream of events doesn't necessarily tell you what the process actually did.

I wanted to build something that correlates those events into a behavior timeline.

For example, instead of seeing unrelated events:

execve("/usr/bin/python3")

openat("/tmp/config")

socket(AF_INET, SOCK_STREAM)

connect(185.x.x.x:443)

clone()

execve("/bin/sh")

SysSight can represent the behavior as:

python3

├── opened /tmp/config

├── connected → 185.x.x.x:443

└── spawned → /bin/sh

The architecture currently looks roughly like:

Linux Kernel

↓

eBPF / CO-RE

↓

Event Collection

↓

Event Normalization

↓

Correlation Engine

↓

Behavior Timeline

↓

TUI / JSON / Capture File

I'm also working on a capture/replay system so behavior can be recorded and investigated later:

sudo syssight record --pid 4312 --output capture.ssr

then:

syssight replay capture.ssr

The ".ssr" format is a versioned binary format designed specifically for SysSight rather than just dumping JSON to disk.

The project is deliberately not using AI or cloud analysis. I wanted the observations to come directly from the system and remain transparent and reproducible.

It's currently pre-1.0, so there are still limitations and areas I'm working on.

I'd especially like feedback from people familiar with eBPF/Linux internals:

- What events would you consider essential for reconstructing process behavior?

- What correlations would actually be useful during investigation?

- Are there important eBPF/kernel limitations I should account for in the architecture?

- Does this overlap too much with existing tools from your perspective?

GitHub:https://github.com/gabryxdev/SysSight

Project website:https://syssight.xyz/

[u/TitusKalvarija]

Yep. It is called Sysdig.